MOBILE FORENSICS Mesut UKŞAL 112692044 İSTANBUL BİLGİ ÜNİVERSİTESİ SOSYAL ...

142 Pages·2015·5.04 MB·Turkish

MOBILE FORENSICS

Mesut UKŞAL
112692044

İSTANBUL BİLGİ ÜNİVERSİTESİ
SOSYAL BİLİMLER ENSTİTÜSÜ
BİLİŞİM VE TEKNOLOJİ HUKUKU YÜKSEK LİSANS
PROGRAMI

Yrd. Dç. Dr. Leyla KESER BERBER

2015

i
ii
MOBİLE FORENSICS
TEZİ HAZIRLAYAN: Mesut UKŞAL
ÖZET

Bilişim teknolojileri dünyasında yaşanan gelişmeler yaşantımıza birçok kolaylık
sunmuş olmasına rağmen güvenlik ihtiyacını ve ahlaki, sosyal sorumlulukları da beraberinde
getirmiştir. Özellikle mobil teknoloji alanındaki gelişmelere paralel olarak akıllı telefon
kullanımının yaygınlaşması, akıllı telefonlar üzerinden işlenen bilişim suçlarının artmasına
sebep olmuştur. Bilişim suçlarının akıllı telefonlar üzerinden işlenmesindeki artış ise bu
konudaki bilişim suçlarının incelenmesi gerekliliğini doğurmuş ve birçok analiz
yazılımları/metotları üretilmiştir, adli bilişim suçları alanında akıllı telefon ve cep
telefonlarının incelenmesi alt başlığı oluşmuş, yalnızca bu konuyu inceleyen uzmanlık
alanları doğmuştur. Bu çalışmada akıllı telefonların adli bilişim kapsamında incelenmesi ile
ilgili önemli detaylar çeşitli telefon, yazılım, uygulama ve çalışmalar karşılaştırılarak
anlatılmıştır.
Presented by: MESUT UKŞAL
ABSTRACT

The advancements in Information Technology presents comfort in our daily lives. On
the other hand these advancements brings with it the need for security and social
responsibilities. Especially in parallel with these advancements, proliferation of smart-phone
usage increased the Information Technology Crimes committed using smart-phones. The
increase in the Information Technology Crimes created the need for investigation of such
crimes and many different analysis techniques/devices have been developed for fighting
against them. In addition, Forensic Investigation of Smart-Phones became an area under
Forensic Investigation and an expertise called “Smart-Phone Forensic Investigation” is born.
In this study, the Smart-Phone Forensic Investigation has been explored by delving into the
details of several smart-phones, forensic application/software and studies.

iii
İÇİNDEKİLER
İÇİNDEKİLER .......................................................................................................................................... 4
KISALTMALAR ....................................................................................................................................... 6
KAYNAKÇA / ELEKTRONİK AĞ ADRESLERİ ................................................................................ 9
ŞEKİLLER LİSTESİ .............................................................................................................................. 15
TABLOLAR ............................................................................................................................................. 17
1. GİRİŞ ...................................................................................................................................................... 1
A. AMAÇ ................................................................................................................................................ 2
2. ADLİ BİLİŞİMİN TANIMI VE SAFHALARI ................................................................................... 2
A. ADLİ BİLİŞİM KAVRAMI VE BİLİŞİM SUÇLARI ..................................................................................... 2
1. Bilişim Kavramı.............................................................................................................................. 2
2. Bilişim Suçu Kavramı ..................................................................................................................... 2
3. Adli Bilişim Kavramı ...................................................................................................................... 3
B. ADLİ BİLİŞİM SAFHALARI .................................................................................................................... 5
1. Delil Toplama (Acquisition/Collection) ......................................................................................... 7
2. İnceleme/Tanımlama (Identification /Examination) ....................................................................... 9
3. Çözümleme/Değerlendirme (Evaluation/Analysis) ...................................................................... 10
4. Raporlama/Sunum (Reporting/Presantation ) .............................................................................. 10
3. MOBİL CİHAZLAR VE GSM TEKNOLOJİSİ .............................................................................. 11
A. MOBİL GSM TARİHİ ......................................................................................................................... 11
B. MOBİL CİHAZ DONANIM VE İŞLETİM SİSTEMLERİ ............................................................................. 15
1. Mobil Cihaz Donanım Yapısı ....................................................................................................... 15
2. Mobil Cihaz İşletim Sistemleri ..................................................................................................... 24
4. MOBİL CİHAZLARDA GÜVENLİK HUSUSLARI ....................................................................... 31
A. MOBİL CİHAZLAR VE GÜVENLİK ....................................................................................................... 32
B. MOBİL CİHAZLARDA GÜVENLİK TEHDİTLERİ ................................................................................... 34
1. Kötücül Yazılımlar (Malware) ...................................................................................................... 35
2. Doğrudan Saldırı (Direct Attacts) ................................................................................................ 37
3. Veri iletişimi Dinleme (Data İnterception) ................................................................................... 39
4. Sosyal Mühendislik ve İstismar (SocialEngineering&Exploitation) ............................................ 40
C. MOBİL CİHAZLARDA İNCELEME YAPMANIN ZORLUKLARI ................................................................ 41
5. MOBİL ADLİ BİLİŞİM YAZILIM/DONANIMLARININ GENEL ÖZELLİKLERİ ................. 43
A. ÜCRETSİZ ADLİ BİLİŞİM YAZILIM VE DONANIMLARI ........................................................................ 43
1. Caine ............................................................................................................................................ 43
2. Deft ............................................................................................................................................... 44
3. Bitpim ........................................................................................................................................... 44
4. Osaf “Open Source Android Forensics” ..................................................................................... 45
5. Pilot-Link ...................................................................................................................................... 45
6. TULP 2G ...................................................................................................................................... 45
B. ÜCRETLİ ADLİ BİLİŞİM YAZILIM VE DONANIMLARI .......................................................................... 46
1. Cellebrite ...................................................................................................................................... 46
2. XRY ............................................................................................................................................... 46
3. Tarantula ...................................................................................................................................... 47
4. Mobiledit ...................................................................................................................................... 48
5. Faraday ........................................................................................................................................ 48
iv
6. Paraben’s Device Seizure ............................................................................................................ 49
7. Oxygen Forensics Suite ................................................................................................................ 50
8. EnCase Neutrino .......................................................................................................................... 50
9. Flasher box ................................................................................................................................... 51
6. MOBİL CİHAZLARDA ADLİ BİLİŞİM SAFHALARI ................................................................. 51
A. CEP TELEFONUNDAN DELİL ÇIKARTMA SÜRECİ ............................................................................... 53
B. DELİL TOPLAMA “EVİDENCE INTAKE COLLECTİON” SAFHASI .......................................................... 54
1. Veri Alanları ................................................................................................................................. 55
2. Dâhili Hafıza ................................................................................................................................ 56
3. Hafıza Kartında Bulunabilecek Veriler ........................................................................................ 57
4. Sim Kart Verileri .......................................................................................................................... 58
C. TANIMLAMA (IDENTİFİCATİON) SAFHASI .......................................................................................... 58
1. Adli Makam/Yasal Merci .............................................................................................................. 59
2. İnceleme Amacı ............................................................................................................................ 60
3. Cihazın Tanımlanması .................................................................................................................. 61
4. CDMA Cep Telefonları ................................................................................................................ 62
5. GSM Cep Telefonları ................................................................................................................... 62
6. Çıkarılabilir Hafıza ...................................................................................................................... 63
D. HAZIRLIK (PREPARATİON) SAFHASI .................................................................................................. 63
1. Uygun Araçların Seçimi ve kapasiteleri ....................................................................................... 64
2. Obje Çıkarımı ............................................................................................................................... 64
3. Mantıksal Çıkarım ........................................................................................................................ 64
4. Fiziksel Çıkarım ........................................................................................................................... 65
5. Cihaz Analiz Seviyeleri ................................................................................................................. 65
E. İZOLASYON (ISOLATİON) SAFHASI ..................................................................................................... 66
F. İŞLEM (PROCESSİNG) SAFHASI ........................................................................................................... 67
G. DOĞRULAMA (VERİFİCATİON) SAFHASI ............................................................................................ 68
1. Çıkartılan Verinin Telefondaki veri ile Karşılaştırılması ............................................................. 69
2. Birden Fazla Araç Kullanılarak Sonuçların Karşılaştırılması..................................................... 69
H. BELGELENDİRME/RAPORLAMA (DOCUMENTATİON/REPORTİNG) SAFHASI ....................................... 70
1. Saat Dilimi Ayarları ..................................................................................................................... 70
İ. SUNUM/ARŞİV (PRESENTATİON/ARCHİVİNG) SAFHASI ....................................................................... 71
7. MOBİL CİHAZLARIN ADLİ BİLİŞİM YAZILIMLARI İLE ANALİZ EDİLMESİ (ÖRNEK
CİHAZ İNCELEMELERİ) ................................................................................................................................ 73
A. ARAŞTIRMA METODOLOJİSİ .............................................................................................................. 73
1. Mantıksal İmaj.............................................................................................................................. 73
2. Fiziksel İmaj ................................................................................................................................. 73
3. Test Ortamı ve Gereksinimler ...................................................................................................... 73
4. Analizler Esnasında Yaşanan Sıkıntılar ....................................................................................... 79
5. Rooting and Jailbreaking ............................................................................................................. 79
6. Senaryo ......................................................................................................................................... 79
B. ARAŞTIRMALAR (ÖRNEK SIM, DÂHİLİ/HARİCİ HAFIZA VE UYGULAMA ANALİZLERİ) ..................... 80
1. XRY Analizleri .............................................................................................................................. 80
2. MobilEdit Analizleri ..................................................................................................................... 92
3. OXYGEN Suite Analizleri ........................................................................................................... 107
C. ARAŞTIRMA BULGULARI ................................................................................................................. 118
8. SONUÇ, YORUM VE ÖNERİLER ................................................................................................. 121

v
KISALTMALAR
PHONE Mobile phone or device
HASH The fixed-size value, or “digital fingerprint” produced by a
BOME Bilgisayar Olaylarına Müdahale Ekibi
TCK Türk Ceza Kanunu
API Application process Interface
GNU General Public License
AP Application processor
BP Baseband Processor
OP Open source Açık Kaynak
CDMA Code Division Multiple Access
CDR Call Detail Record
CF Compact Flash
CNIC Cellular Network Isolation Card
CSIM Subscriber Identity Module
EDGE Enhanced Data for GSM Evolution
EMS Enhanced Messaging Service
ESN Electronic Serial Number
ETSI European Telecommunications Standards Institute
eUICC Embedded Universal Integrated Circuit Card
FCC ID Federal Communications Commission Identification Number
GPRS General Packet Radio Service
GPS Global Positioning System
GSM Global System for Mobile Communications
http HyperText Transfer Protocol
ICCID Integrated Circuit Card Identification
IDE Integrated Drive Electronics
iDEN Integrated Digital Enhanced Network
vi
IM Instant Messaging
IMAP Internet Message Access Protocol
IMEI International Mobile Equipment Identity
IMSI International Mobile Subscriber Identity
IrDA Infra Red Data Association
JTAG Joint Test Action Group
LCD Liquid Crystal Display
LED Light Emitting Diode
LND Last Numbers Dialed
MD5 Message Digest 5
MEID Mobile Equipment Identifier
MMC Multi-Media Card
MMS Multimedia Messaging Service
MSC Mobile Switching Center
MSISDN Mobile Subscriber Integrated Services Digital Network
NFC Near Field Communication
OS Operating System
PC Personal Computer
PDA Personal Digital Assistant
PIM Personal Information Management
PIN Personal Identification Number
PPI Pixels Per Inch
POP Post Office Protocol
RAM Random Access Memory
ROM Read Only Memory
SD Secure Digital
SDK Software Development Kit
SHA1 Secure Hash Algorithm, version 1
vii
SHA2 Secure Hash Algorithm, version 2
SIM Subscriber Identity Module
SMS Short Message Service
SSD Solid State Drive
TDMA Time Division Multiple Access
UICC Universal Integrated Circuit Card
UMTS Universal Mobile Telecommunications System

viii
KAYNAKÇA / ELEKTRONİK AĞ ADRESLERİ
Ekim Ahmet : Ahmet EKİM, Mobil Cihazlarda adli Bilişim ve Malware Analizi,
http://www.bilgisayardedektifi.com/mobil-cihazlarda-adli-bilisim-ve-malware-
analizi/206,
QQ
Paul McCarty Paul McCarthy, School of Computer and Information Science Mawson Lakes
Forensic Analysis of Mobile Phones October 2005 s.3
http://www.8051projects.net/files/public/1236046309_9698_FT19075_forensi
c_analysis_of_mobile_phones.pdf, QQ

İnternet : TDK “Güncel Türkçe Sözlük” www.tdk.gov.tr,
QQ
İnternet : Bilişim Suçları Kapsamında Dijital Deliller,
http://ab.org.tr/ab05/tammetin/134.pdf/

İnternet : İstanbul Barosu Dergisi Sayı: “Bilişim Suçu” Mart-Nisan 2014
http://www.istanbulbarosu.org.tr/proje/dergi/19/files/assets/basic-
html/page241.html

Dülger : DÜLGER, Murat Volkan. “Turk Ceza Kanunu’nda Yer Alan Bilisim Sucları
ve Elestirisi” http://www.dulger.av.tr/pdf/ytkbilisimsucelestrisi.pdf
QQ
Berber : Keser Berber, Adli Bilişim, CMK md 134 ve Düşündürdükler,
http://www.leylakeser.org/2008/07/adli-biliim-cmk-md-134-ve-
dndrdkleri.html 17/05/2014
QQ
İnternet : Interpol Computer Crime Manuel 2. Officer, İnterpol, s.10 QQ

Uzunay : UZUNAY, Yusuf; BICAKCI, Kemal. A3D3M: Açik Anahtar Altyapisi
DESTEKLI DIGITAL Delilleri Doğrulama Modeli
http://www.emo.org.tr/ekler/4843973f9b66701_ek.pdf./ QQ

Casey : Casey, E. (200s4). Digital Evidence and Computer Crime: Forensic Science,
Computers,and the Internet, 2nd Ed., Academic Press.
http://www.google.com.tr/books?hl=tr&lr=&id=DQdWRitMcyAC&oi=fnd&p
g=PP2&dq=Digital+Evidence+and+Computer+Crime&ots=t4uH0Y4WsI&sig
=TLAsvz-
Vh3k7pOTQmUVzyWBOKJE&redir_esc=y#v=onepage&q=Digital%20Evide
nce%20and%20Computer%20Crime&f=false
QQ
Hüseyin Çakır : Hüseyin ÇAKIR / Ercan SERT, Bilişim Suçlarını Delillendirme Süreçi
Ercan SERT http://utsam.org/images/upload/attachment/utsas_2010_secilmis/Bili%C5%9Fi
m%20Su%C3%A7lar%C4%B1%20ve%20Delillendirme%20S%C3%BCreci.
pdf/ QQ Q

Keser Berber : KESER BERBER, L.(2004). Adli Bilisim. Ankara, Yetkin Yayınları, s.:56-60
ISBN 975-464-299-0

Ekizer : Ekizer, A. H. (2014). Adli Bilişim - Computer Forensics,
http://www.ekizer.net/adli-bilisim-computer-forensics/ (Et: 18.09.2014) QQ

İnternet : Adli Bilişim, http://edirnebarosu.org.tr/incelemeler/adli-bilisim-computer-
forensic/
QQ
İnternet : http://www.hukuksokagi.com/kaynak/adli-bilisim-computer-forensic/ Q
Q
Yusoff,Yunus,Is : YUSOFF, Yunus; ISMAIL, Roslan; HASSAN, Zainuddin. Common phases of
mail,Roslan,Ha computer forensics investigation models. International Journal of Computer
ssan Science & Information Technology, 2011, 3.3: 17-31.
ix
http://airccse.org/journal/jcsit/0611csit02.pdf
Q
İnternet : Ekizer, http://www.ekizer.net/adli-bilisim-computer-forensics/ QQ

Saudi-Madihah : SAUDI, Madihah Mohd. An overview of disk imaging tool in computer
Mohd forensics. SANS Institute, 2001. http://www.sans.org/reading-
room/whitepapers/incident/overview-disk-imaging-tool-computer-forensics-
643
QQ
Casey,Eoghan : CASEY, Eoghan; TURNBULL, Benjamin. Digital evidence on mobile
devices. Eoghan Casey, Digital Evidence and Computer Crime. Third Edition.
Forensic Science, Computers, and the Internet, Academic Pres, 2011.
http://booksite.elsevier.com/9780123742681/Chapter_20_Final.pdf
QQ
Kruger : Kruger, 2011). Krueger, C. (2011, February 11). Man found guilty of lesser
charge in murder recorded on cellphone
http://www.tampabay.com/news/courts/criminal/man-found-guilty-of-lesser-
charge-in-murder-recorded-on-cell-phone/1150957

Cas,Eoghan : CASEY, Eoghan. Handbook of digital forensics and investigation. Academic
Press, 2009.
http://www.google.com.tr/books?hl=tr&lr=&id=xNjsDprqtUYC&oi=fnd&pg=
PP2&dq=van+der+Knijff,+Handbook+of+Digital+Forensics+and+Investigatio
n+2009%3B+&ots=X2tNE-
aCtL&sig=4yZF_a2v_D1AQfl8OHC5QGabw2c&redir_esc=y#v=onepage&q
=van%20der%20Knijff%2C%20Handbook%20of%20Digital%20Forensics%2
0and%20Investigation%202009%3B&f=false
Nist : National Institute of Standards and Technology. “Guidelines on Cell Phone
and PDA Security (SP 800-124).”
http://csrc.nist.gov/publications/nistpubs/800-124/SP800-124.pdf

QQ
Symantec : Symantec. “Symantec Report Finds Cyber Threats Skyrocket in Volume
andSophistication.”
http://www.symantec.com/about/news/release/article.jsp?prid=20110404_03

Hassell,Lewis : HASSELL, Lewis; WIEDENBECK, Susan. Human factors and information
security. Manuscript. Available at: http://repository. binus. ac. id/content A,
2004, 334. http://repository.binus.ac.id/content/A0334/A033461622.pdf
QQ
Huang,Ding- : HUANG, Ding-Long; RAU, Pei-Luen Patrick; SALVENDY, Gavriel. A
Long-Rau-Pei- survey of factors influencing people’s perception of information security. In:
Luin Patrick Human-Computer Interaction. HCI Applications and Services. Springer Berlin
Heidelberg, 2007. p. 906-915.
https://books.google.com.tr/books?id=BVy5BQAAQBAJ&pg=PA107&dq=H
uman-
Computer+Interaction.+HCI+Applications+and+Services&hl=tr&sa=X&ei=U
xshVYKTJ4X5UtaOg6AH&ved=0CB4Q6AEwAQ#v=onepage&q=Human-
Computer%20Interaction.%20HCI%20Applications%20and%20Services&f=f
alse

İnternet : https://www.bilgiguvenligi.gov.tr/mobil-cihaz-guvenligi/mobil-cihazlarda-
guvenlik-android-ve-ios-karsilastirmasi.html
QQ
Juniper : Juniper Networks, 2011, Inc. Mobile Device Security Emerging Threats,
Networks Essential Strategies
http://www.adtechglobal.com/Data/Sites/1/marketing/juniperwhitepapermobil
edevicesecurity.pdf
QQ
x